Privacy Policy cas3 – How We Protect Your Data

Introduction

This Privacy Policy ("Policy") sets out cas3's privacy practices regarding the collection, use, storage, and protection of personal data belonging to users of the platform cas3.xyz. This policy applies to all individuals who access or use cas3's services, including registered members and website visitors.

By registering an account or continuing to use the cas3 platform, you confirm that you have read and understood this Privacy Policy. cas3 is committed to protecting your privacy rights as a Malaysian user and to complying with the Personal Data Protection Act 2010 (PDPA) Malaysia and all relevant legislation.

1 Data We Collect

1.1 Data You Provide Directly

When you register a cas3 account or use our services, you provide certain information to us directly. This includes:

• Identity Information: Full name as per MyKad, date of birth, Malaysian identification card number.
• Contact Information: Email address, Malaysian mobile phone number.
• Financial Information: The payment methods you use — Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX (we do not store bank account details or credit card numbers directly).
• Verification Documents: A copy of your MyKad or other documents for the KYC (Know Your Customer) process where required.
• Profile Information: Username, profile photo (if uploaded), and language preference.

1.2 Data Collected Automatically

When you use the cas3 platform, certain information is automatically collected by our systems to maintain security and service quality:

• Technical Data: IP address, web browser type, device operating system, and screen resolution.
• Activity Data: Pages visited, games played, bets placed, and session duration.
• Transaction Data: Deposit history, withdrawals, winnings, and betting records.
• Location Data: General location information derived from your IP address for geographical verification purposes.
• Cookie Data: Information stored by cookies in your browser (see Section 5 for details).

2 Purpose of Data Use

2.1 Account Management & Services

The primary purpose for which cas3 collects your data is to deliver platform services effectively. This includes registering and verifying new accounts, processing deposits and withdrawals via eWallet and FPX Malaysia, identity verification (KYC) to meet compliance requirements, providing responsive customer support, and sending account-related notifications such as transaction confirmations and password resets.

2.2 Platform Security

Cas3 uses user data to maintain platform security for all members. This includes detecting and preventing fraud, money laundering, and account abuse. Our monitoring systems analyse transaction patterns and gaming activity to identify suspicious behaviour — not to track your personal activity outside the platform.

2.3 Product Improvement

Anonymized and aggregated usage data helps cas3 understand how players interact with the platform. This information is used to improve interface design, enhance game performance, and develop new features more relevant to Malaysian players' needs — such as support for more eWallet payment methods or the addition of local sports leagues.

2.4 Marketing Communications

With your consent, cas3 may use your email address and phone number to send you information about promotions, bonuses, and the latest offers. You may withdraw this consent at any time through your account settings or by clicking the "unsubscribe" link in any promotional email. Withdrawing your consent will not affect your access to cas3's core services.

2.5 Legal Compliance

Cas3 is required to retain certain records to meet its legal and regulatory obligations, including anti-money laundering (AML) requirements and tax compliance. This data is retained for the period stipulated by relevant Malaysian laws and is not used for any other purpose.

3 Data Sharing With Third Parties

3.1 General Principles

Cas3 does not sell, rent, or disclose your personal data to third parties for marketing or commercial purposes. Data sharing only occurs in limited situations required for service operations or legal compliance.

3.2 Trusted Service Providers

Cas3 works with a number of third-party service providers that are necessary for the operation of the platform. All such providers are bound by strict data confidentiality agreements and are only permitted to use your data for the specific purposes outlined in their contracts with cas3. These providers include:

• Payment Gateway: eWallet and FPX processors used for deposits and withdrawals — they receive only the transaction information necessary to process your payment.
• Game Providers: Gaming software companies that supply slots, live dealer, and table games — session data is shared to ensure games function correctly.
• Identity Verification Services: Third-party KYC platforms that assist in verifying identity documents — they only receive the documents required for verification.
• Analytics Services: Analytics tools that help us understand platform usage — only anonymised and aggregated data is shared.

3.3 Disclosure Required by Law

Cas3 may be required to disclose your data to the relevant authorities when mandated by Malaysian law, a court order, or a directive from a lawful authority. In such situations, cas3 will endeavour to notify you in advance unless doing so is prohibited by law or could compromise an ongoing investigation.

4 Security & Data Storage

4.1 Technical Security Measures

Cas3 invests seriously in security infrastructure to safeguard your personal data. The technical measures we have implemented include:

• 256-bit SSL/TLS encryption for all data communications between your browser and cas3 servers.
• Sensitive data in the database is encrypted — passwords are stored in hashed form and cannot be read by anyone.
• Strict access controls — only authorised staff with a legitimate business need are permitted to access user data.
• 24/7 security monitoring and intrusion detection systems.
• Regular data backups to ensure recovery in the event of a technical emergency.
• Regular security testing including third-party penetration testing.

4.2 Data Retention Period

Cas3 retains your personal data only for as long as necessary for the purposes outlined in this Privacy Policy, or as required by law. In general:

• Active account data: Retained for as long as your account remains active and for an additional period following account closure in accordance with legal requirements.
• Financial transaction records: Retained for a minimum of 7 years in accordance with Malaysian financial legal requirements.
• Technical and security logs: Typically retained for 12 months for investigation purposes in the event of a security incident.
• Marketing data: Deleted within 30 days of you withdrawing consent to receive marketing communications.

4.3 What You Need to Do

Data security is a shared responsibility. You can help protect your cas3 account by using a strong and unique password, never sharing your password with anyone, logging out of your account when using a shared device, and notifying cas3 immediately if you suspect any unauthorised activity on your account.

5 Cookies & Tracking Technologies

5.1 What Are Cookies?

Cookies are small text files stored in your web browser when you visit the cas3 platform. They help cas3 remember your preferences, keep you securely logged in between sessions, and understand how visitors use our platform so we can continue improving it.

5.2 Types of Cookies Used by cas3

• Essential Cookies: Required for core platform functionality — including login session management and security. These cookies cannot be disabled without affecting how the platform operates.
• Preference Cookies: Saves your preferences such as language and display settings for a smoother experience on return visits.
• Analytics Cookies: Collects information about how you use the platform in anonymised form to help us improve our services.
• Security Cookies: Helps us detect suspicious activity and protect your account from unauthorised access.

5.3 Managing Your Cookie Preferences

You can manage or delete cookies through your web browser settings. Please note that disabling certain cookies may affect the functionality of the cas3 platform — particularly essential cookies required to keep you logged in. Below is an example of how the cas3 cookie notice appears:

*Sample cookie notice display — for illustration purposes only.

6 Your Rights as a User

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and cas3's internal policies, you have the following rights regarding your personal data:

6.1 Right of Access

You have the right to request a copy of the personal data cas3 holds about you. Data access requests can be submitted by emailing support@cas3.xyz with "Data Access Request" as the subject line. cas3 will process such requests within 14 business days.

6.2 Right to Rectification

If you find that the personal data cas3 holds about you is inaccurate, incomplete, or out of date, you have the right to request a correction. Certain details such as your username and email address can be updated directly through your account settings. For changes to primary identity information, please contact cas3 support with the relevant supporting documents.

6.3 Right to Erasure

In certain circumstances, you may request that cas3 delete your personal data. However, please note that full deletion may not always be possible if cas3 is legally required to retain certain records — particularly financial transaction records mandated under Malaysian law. cas3 will inform you of any limitations that apply to your deletion request.

6.4 Right to Object to Marketing

You have the right to object to the use of your data for direct marketing purposes at any time. This can be done through the "Communication Preferences" section in your cas3 account settings, or by emailing support@cas3.xyz. Requests to opt out of marketing communications will be processed within 5 business days.

7 Cross-Border Data Transfers

In operating the cas3 platform, some data may be processed or stored on servers located outside Malaysia — primarily in connection with technical service providers or international gaming software providers that cas3 works with.

When this occurs, cas3 ensures that any cross-border data transfers are carried out with adequate safeguards in place. This includes verifying that the recipient country offers a comparable level of data protection, or through data transfer agreements containing recognized standard protection clauses.

Sensitive financial data and primary identity information of Malaysian users are prioritized for storage on servers closer to Malaysia in the Southeast Asian region, to minimize long-distance data transfers while maintaining service speed and reliability.

8 Changes to This Privacy Policy

Cas3 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our practices, legal requirements, or how our services operate. Whenever the Privacy Policy is updated, the "Last Updated" date at the top of this document will be revised to reflect the latest amendment.

For material changes that significantly affect how your data is processed, cas3 will provide clear notice to members via email or in-platform notification before those changes take effect. For minor changes or language clarifications, amendments may take effect immediately without separate notice.

We encourage you to review this Privacy Policy periodically. Your continued use of the cas3 platform after any amendments are published will be considered your acceptance of the updated policy.

9 Contact Us

If you have any questions, concerns, or requests regarding cas3's Privacy Policy or how we handle your personal data, please reach out to us through the following channels:

• Email: support@cas3.xyz (use "Privacy Enquiry" as the subject line)
• Live Chat: Available 24/7 via the cas3 platform
• Response Time: We aim to respond to all privacy-related enquiries within 2 business days

For formal requests relating to data protection rights under Malaysia's PDPA, please submit a written request to support@cas3.xyz with the subject line "PDPA Rights Request", along with your full name and account number for reference. cas3 will process all valid requests within the timeframe stipulated by law.

Cas3 also welcomes your feedback on our privacy practices. If you feel any aspect of this Privacy Policy could be clarified or improved, your input is greatly valued and will be considered in future policy reviews.